Capcom Hack Did Leak Customer Data After All

Earlier this month, Capcom announced that it had recently been hacked, but assured customers that their personal data wasn't compromised in the attack. I celebrated this as a rarity, as generally customer data is the first thing leaked in such attacks, but perhaps my first reaction was a bit too optimistic and naive, because Capcom has just updated the situation, and, indeed, customer information was among the data that was stolen.

From a new press release on their website:

As there is an ongoing investigation in place, it is possible that new facts may come to light going forward. Below is a general summary of what has been confirmed at this point in time (as of November 16, 2020).
1. Information verified to have been compromised
i. Personal information: 9 items
Personal information of former employees: 5 items
(Name & signature: 2 items; name & address: 1 item; passport information: 2 items)
Personal information of employees: 4 items
(Name and HR information: 3 items; name & signature: 1 item)
ii. Other information
Sales reports
Financial information
2. Potentially compromised data
i. Personal information (customers, business partners, etc.): maximum of approx. 350,000 items
Japan: Customer service video game support help desk information (approx.134,000 items)
Names, addresses, phone numbers, email addresses
North America: Capcom Store member information (approx. 14,000 items)
Names, birthdates, email addresses
North America: Esports operations website members (approx. 4,000 items)
Names, email addresses, gender information
List of shareholders (approx. 40,000 items)
Names, addresses, shareholder numbers, amount of shareholdings
Former employees' (including family) information (approx. 28,000 people);
applicants' information (approx. 125,000 people)
Names, birthdates, addresses, phone numbers, email addresses, photos, etc.
ii. Personal information (employees and related parties)
Human resources information (approx. 14,000 people)
iii. Confidential corporate information
Sales data, business partner information, sales documents, development documents, etc.
None of the at-risk data contains credit card information. All online transactions etc. are handled by a third-party service provider, and as such Capcom does not maintain any such information internally.

So names, addresses, and phone numbers. Nothing terribly dangerous, at least in the hands of hackers, but nothing people can easily change. An unfortunate update, but there's not a whole lot to be done about it either.